CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 301:

  Which of the following is NOT supported by CPUSE?

  A. Automatic download of full installation and upgrade packages
  B. Automatic download of hotfixes
  C. Installation of private hotfixes
  D. Offline installations
  D. Offline installations

  ---

  Explanation

  The option that is not supported by CPUSE is offline installations. CPUSE (Check Point Update Service Engine) is a Gaia software update agent that manages software updates on Gaia OS and Check Point products. It requires an internet connection to download and install updates from the Check Point Cloud or a local Deployment Agent. The other options are supported by CPUSE. It can automatically download full installation and upgrade packages, hotfixes, and private hotfixes. It can also install them manually or automatically according to a schedule.

  References:

  [CPUSE Overview] (https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_AdminWebAdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_Gaia_AdminWebAdminGuide/112109)

• Question 302:

  Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible.

  Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

  A. fw tab -t connections -s
  B. fw tab -t connections
  C. fw tab -t connections -c
  D. fw tab -t connections -f
  B. fw tab -t connections

  ---

  Explanation

  The command that may impact performance briefly and should not be used during heavy traffic times of day is fw tab -t connections. This command displays all the entries in the connections table, which can be very large and consume a lot of CPU resources. The other commands are less intensive and can be used safely. The command fw tab -t connections -s displays only the statistics of the connections table, such as number of entries, peak size, etc. The command fw tab -t connections -c clears all the entries in the connections table. The command fw tab -t connections -f displays only the entries that match a filter expression.

  References:

  [fw tab Command]

• Question 303:

  How can SmartView application accessed?

  A. http://<Security Management IP Address>/smartview
  B. http://<Security Management IP Address>:4434/smartview/
  C. https://<Security Management IP Address>/smartview/
  D. https://<Security Management host name>:4434/smartview/
  C. https://<Security Management IP Address>/smartview/

  ---

  Explanation

  SmartView is a web-based application that allows you to view and analyze logs, reports, and events from multiple Check Point products. You can access SmartView by using the following URL:

  You need to use HTTPS protocol and the default port 443. You also need to enter the IP address of the Security Management Server that hosts the SmartView application. You cannot use the host name of the Security Management Server or a different port number.

  References:

  SmartView R81 Administration Guide

• Question 304:

  Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

  A. ThreatWiki
  B. Whitelist Files
  C. AppWiki
  D. IPS Protections
  B. Whitelist Files

  ---

  Explanation

  According to the Check Point website, Whitelist Files is the tool that provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed. Whitelist Files can be configured in SmartConsole under Threat Prevention > Policy > Whitelist Files. The other tools are either not related or not valid tools.

  References:

  Whitelist Files

• Question 305:

  Which is NOT a SmartEvent component?

  A. SmartEvent Server
  B. Correlation Unit
  C. Log Consolidator
  D. Log Server
  C. Log Consolidator

  ---

  Explanation

  Log Consolidator is NOT a SmartEvent component. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. Log Consolidator is not a valid component or blade of SmartEvent.

• Question 306:

  What command is used to manually failover a cluster during a zero-downtime upgrade?

  A. clusterXL_admin down
  B. set cluster member down
  C. cpstop
  D. set clusterXL down
  A. clusterXL_admin down

• Question 307:

  Which of the SecureXL templates are enabled by default on Security Gateway?

  A. NAT
  B. Drop
  C. None
  D. Accept
  D. Accept

• Question 308:

  In which deployment is the security management server and Security Gateway installed on the same appliance?

  A. Standalone
  B. Remote
  C. Distributed
  D. Bridge Mode
  A. Standalone

  ---

  Explanation

  In a Standalone deployment, a Check Point computer runs both the Security Gateway and Security Management Server products. This means that the same appliance performs both network security functions and security policy management functions. A Standalone deployment is suitable for small or branch offices that do not require a separate management server.

  References:

  Check Point R81 Installation and Upgrade Guide, page 10

• Question 309:

  An administrator would like to troubleshoot why templating is not working for some traffic.

  How can he determine at which rule templating is disabled?

  A. He can use the fw accel stat command on the gateway.
  B. He can use the fw accel statistics command on the gateway.
  C. He can use the fwaccel stat command on the Security Management Server.
  D. He can use the fwaccel stat command on the gateway
  D. He can use the fwaccel stat command on the gateway

  ---

  Explanation

  The fwaccel stat command on the gateway shows the status of SecureXL acceleration, including the number of accelerated and non-accelerated connections and the reasons for non-acceleration. The reasons for non-acceleration can be either a rule that disables templating or a feature that is not supported by SecureXL. To determine which rule disables templating, the administrator can use the -s option to show the rule numbers and names. For example:

  [Expert@GW1]# fwaccel stat -s

  Accelerated conns/Total conns : 10/100 (10%) Accelerated pkts/Total pkts : 1000/2000 (50%)

  F2Fed pkts/Total pkts : 500/2000 (25%)

  F2F pkts/Total pkts : 500/2000 (25%)

  Template packets: 100

  Reasons for disabled templates:

  Rule 5: No NAT

  Rule 10: Log

• Question 310:

  How many versions, besides the destination version, are supported in a Multi-Version Cluster Upgrade?

  A. 4
  B. 3
  C. 2
  D. 1
  D. 1